Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
= Usermode = | = Usermode = | ||
== | == TheFloW's usermode exploit == | ||
We have no information on this such as which usermode module it exploits. | |||
See [https:// | See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)]. | ||
Potentially unpatched. | |||
== WebKit exploits == | == WebKit exploits == | ||
Line 34: | Line 17: | ||
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | * It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | ||
=== | === FW 9.00-9.03 - WebCore::CSSFontFaceSet vulnerabilities leading to addrof/fakeobj === | ||
Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of PS5memory protections. | |||
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.03_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | |||
See | |||
== Game savedata exploits == | == Game savedata exploits == | ||
Nothing yet. | |||
== PS4 emulator exploits == | == PS4 emulator exploits == | ||
Line 84: | Line 33: | ||
= Kernel = | = Kernel = | ||
== | == <= 4.50 - exFAT driver OOB == | ||
Not yet exploited because no public usermode exploit has been released yet. | |||
See | See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_OOB] | ||
Not yet patched. | |||
' | == TheFloW's kernel exploit == | ||
Not released yet. | |||
See | See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)]. | ||
Potentially unpatched. | |||
== SMAP bypass (CVE-2021-29628) == | == SMAP bypass (CVE-2021-29628) == | ||
* Discovered and disclosed publicly by m00nbsd. Disclosed to Sony on 2020-12-01. | |||
* Discovered and disclosed publicly by m00nbsd. Disclosed to | |||
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP is not coming from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched. | |||
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | * [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | ||
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd] | * [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd] | ||
See also [https://www.psdevwiki.com/ps4/Working_Exploits#Kernel_SMAP]. | |||
Patched on PS5 FW 2.30 or later according to dates. | |||
= Secure Kernel = | = Secure Kernel = | ||
Line 181: | Line 66: | ||
== Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel == | == Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel == | ||
See [https://www.psdevwiki.com/ps4/ | See [https://www.psdevwiki.com/ps4/Bugs_%26_Vulnerabilities#Partial_SAMU_KeyRings_bruteforce_by_missing_HMAC_length_check_in_secure_kernel]. | ||
Potentially vulnerable on PS5 FWs <= 4.03. | Potentially vulnerable on PS5 FWs <= 4.03. |